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EXECUTIVE OFFICE OF THE PRESIDENT 
OFFICE OF MANAGEMENT AND BUDGET 
WASHINGTON, D C 20503 




MAir 24 085 


MEMORANDUM FOR THE SENIOR AGENCY OFFICIALS FOR INFORMATION 
RESOURCES MANAGEMENT 

FROM: Robert P. Bedel 

Deputy Administrator 
Office of Information and 
Regulatory Affairs 


SUBJECT: 


Privacy Act Guidance - Update 


Section (6) of the Privacy Act of 1974 requires OMB to issue 
"guidelines and regulations" to help the agencies implement the 
Act's provisions. We issued comprehensive Guidelines in 1975 and 
have updated them on an ad hoc basis since then. In 1983, at 
oversight hearings before the House Subcommittee on Government 
Information, Justice and Agriculture, the then Administrator of the 
Office of Information and Regulatory Affairs, Christopher DeMuth, 
testified that we were working on a comprehensive update of that 
guidance to consolidate the existing pieces and to make it conform 
to the case law that had evolved. 

While we are, in fact, working on such a wholesale revision, there 
are three specific areas that deserve your immediate attention. 

Some recent court decisions and congressional action have called 
into question our existing guidance in the following areas: 

1. Agencies' disclosures of personal information from systems of 
records during the course of litigation. 

2. The disclosure of personal information from Privacy Act files 
pursuant to Section (b) (2) , which allows agencies to make 
non-consensual disclosures if the disclosure would be 
"required" under the Freedom of Information Act. 

3. The relationship between the exemption provisions of the 
Privacy Act and those of the Freedom of Information Act. 

The attachment to this memorandum discusses each of these areas and 
suggests specific remedial steps your agency can take. You should 
take action as quickly as possible. 

To help speed things along, copies of this memorandum have been 
sent to your agency's Privacy Act Officer and Office of the General 
Counsel. Please refer any questions to Robert N. Veeder of my 
staff at 395-4814 or Cecelia Wirtz of our General Counsel's office 
at 395-5600. 

Attachment 
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Office of Management and Budget 
Office of Information and Regulatory Affairs 

Privacy Act Guidance Updated 

This document identifies three areas in which agencies 
should amend their practices to conform to new 
interpretations of the Privacy Act which have resulted 
from recent congressional action or judicial 
interpretations. 

In each case, we identify the problem, provide 
background, and offer a recommendation ’ for agency action 
to mitigate the effects of the problem. 

1. Problem - Disclosures of Privacy Act material during 
litigation. 

A recent D.C. District Court decision has called into 
question the legality of the "routine use" Federal Bureau 
of Investigation relies upon to disclose individually 
identifiable information in the course of litigation. By 
extension, this problem confronts not only the FBI, but 
potentially many other agencies, as well. 

a. Background 

The Privacy Act requires agencies to obtain the written 
consent of record subjects before disclosing their 
records from agency systems of records. It also provides 
12 specific exceptions to this requirement. For 
disclosures during litigation, agencies generally rely on 
the following two exceptions: 

o Subsection (b) ( 11 ) , "pursuant to the order of a 
court of competent jurisdiction;" or 

o Subsection (b)(3), for a "routine use." The 

"routine use" exception provides that an agency may 
make a nonconsensual disclosure for a routine use 
that is compatible with the purpose for which it 
collected the information . An example is the 
disclosure of time and attendance information from 
an agency to the Treasury Department to permit the 
Treasury to issue checks to the agency's employees. 

Disclosures initiated by the government generally take 
place as routine use exceptions. 

In Krohn v. Department of Justice , Civil No. 78-1536 
(D.D.C., Mar. 19, 1984), Judge Harold Greene ruled that 
an FBI routine use that provided for disclosure "during 
appropriate legal proceedings" was "vague and capable of 
being construed so broadly as to encompass all legal 
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proceedings. .. [and] would make disclosure as a 'routine 
use' the rule rather than the exception and thus subvert 
the purposes of the Act.” 

In holding that the Justice Department acted improperly 
in disclosing records pursuant to this routine use. Judge 
Greene opened the door for Krohn to collect damages from 
the Department. (Note: Judge Greene reversed himself on 
Krohn's eligibility for damages, deciding that the 
disclosure was not "wilful or intentional" since the 
Department acted in good faith on what it thought to be a 
valid routine use). 

As a result of Krohn , 0MB selectively reviewed agencies' 
existing routine uses for disclosures in support of 
litigation and found that many could be improved 
substantially. 

b. Recommended Agency Action 

Agencies should adopt better routine uses to support 
disclosures of Privacy Act records during litigation; 
none of the other disclosure exceptions found in Section 
(b) will serve. Nor is it likely that a record subject 
would provide written consent for such disclosures. Such 
routine uses should be adopted uniformly by the agencies 
and applied across the board to all of their systems of 
records. 

To be effective, such routine uses must accommodate the 
following concerns: 

o They should not be so narrowly drawn so as to 
restrict the flow of relevant and necessary 
information; 

o They should be narrowly enough drawn to meet Judge 
Greene's concern that "the threat of the 
government's unrestricted ability to disclose 
personal and embarrassing material as part of or in 
retaliation for suit being brought against it could 
discourage meritorious claims from being filed." 
Laningham v. United States Navy , (Civil No. 83-3238, 
D.D.C. , Sep 25, 1984) . 

o They must address the issue of compatibility by 
incorporating a statement that any disclosures of 
information will be compatible with the purpose for 
which the agency collected the information. 

Agencies, of course, will have to establish 
procedures to verify such compatibility before 
disclosing pursuant to this use. 
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We urge that the agencies, therefore, adopt the following 
routine uses for each of their systems: 

Routine Use for Disclosure to the Department of 
Justice for Use in Litigation : 

"It shall be a routine use of the records in 
this system of records to disclose them to the 
Department of Justice when 

(a) the agency, or any component thereof; or 

(b) any employee of the agency in his or her 
official capacity; or 

(c) any employee of the agency in his or her 
individual capacity where the Department of 
Justice has agreed to represent the employee; 
or 

(d) the United States, where the agency 
determines that litigation is likely to affect 
the agency or any of its components, 

is a party to litigation or has an interest in 
such litigation, and the use of such records by 
the Department of Justice is deemed by the 
agency to be relevant and necessary to the 
litigation, provided, however, that in each 
case, the agency determines that disclosure of 
the records to the Department of Justice is a 
use of the information contained in the records 
that is compatible with the purpose for which 
the records were collected." 

Routine Use for Agency Disclosure in 
Litigation : 

"It shall be a routine use of records 
maintained by this agency to disclose them in a 
proceeding before a court or adjudicative body 
before which the agency is authorized to 
appear, when 

(a) the agency, or any component thereof; or 

(b) any employee of the agency in his or her 
official capacity; or 

(c) any employee of the agency in his or her 
individual capacity where the agency has agreed 
to represent the employee; or 
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(d) the United States, where the agency 
determines that litigation is likely to affect 
the agency or any of its components, 

is a party to litigation or has an interest in 
such litigation, and the agency determines that 
use of such records is relevant and necessary 
to the litigation, provided, however, that in 
each case, the agency determines that 
disclosure of the records to the Department of 
Justice is a use of the information contained 
in the records that is compatible with the 
purpose for which the records were collected." 

Before disclosing pursuant to either of these routine 
uses, agencies should thoroughly review any proposed 
disclosures for conformance with the provisions of the 
routine use and any other applicable provisions of the 
Privacy Act, e.g., section (e)(6). This review must 
support a finding that the proposed disclosure is 
compatible with the underlying purpose of the original 
collection of the data. In any case, the records 
disclosed should be only those directly necessary and 
relevant to support the litigation. 

2 . Problem - Disclosures pursuant to Section (b)(2) . 

The Court of Appeals for the D.C. Circuit recently ruled 
that before disclosing records pursuant to section (b)(2) 
of the Privacy Act, agencies must have a Freedom of 
Information Act request in hand. 

a. Background 

Section (b) (2) of the Privacy Act permits agencies to 
make nonconsensual disclosures of information from 
systems of records if those disclosures would be required 
under the Freedom of Information Act. 

In Bartel v. Federal Aviation Administration, et. al. 725 
F.2d 1403 (D.C. Cir. 1984), the court interpreted section 
(b) (2) to mean that an agency may not make a 
"nonconsensual disclosure of Privacy Act material unless 
the agency acts pursuant to a FOIA request. " In 
comparing the two acts, the court noted that while the 
Freedom of Information Act was intended to limit "agency 
discretion to deny public access to information in its 
files," the Privacy Act was designed "to limit agency 
discretion to reveal personal information in its files." 
If the (b) (2) exception were read to permit agencies to 
disclose, at will, from their systems without a 
triggering mechanism such as a FOIA request, it would 
effectively increase agency discretion "to disclose 
information where disclosure is otherwise prohibited by 
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the Privacy Act." The court found that such an 
interpretation would be inconsistent with the thrust of 
the Privacy Act, which is to limit agency discretion. 

The correct interpretation, according to the court, is 
that it is only "when the agency is faced with a FOIA 
request for information that is not within a FOIA 
exemption, and therefore has no discretion but to 
disclose the information, does the FOIA exception to the 
Privacy Act come into play." 

The court also cited the OMB Implementing Guidelines in 
support of its interpretation, but misinterpreted them in 
a key way. The problem lies with the court's analysis of 
the "Disclosure to the Public" section of the Guidelines 
which overlooks the distinction made between mandatory 
versus discretionary releases made under the FOIA. The 
Guidelines advise that "tG]iven the use of the term 
'required', agencies may not voluntarily make public any 
record which they are not required to release (i.e., 
those they are permitted to withhold) without the consent 
of the individual unless that disclosure is permitted 
under one of the other portions of this subsection." 

This sentence simply means that records which fall within 
one of the nine FOIA exemptions may not be released under 
(b) (2) of the Privacy Act. The section does not state, 
nor was it intended to imply, that an actual FOIA request 
is required to release records that would be subiect to 
mandatory release under the FOIA. 

Contrary to the court's reasoning, this approach does not 
increase agency discretion to disclose information where 
disclosure is otherwise prohibited by the Privacy Act. 
What it does is clarify that the two statutes must be 
read in tandem on this issue. Most importantly, it 
maintains the status quo : no information is released 
which would not otherwise be required to be released 
under the FOIA. 

If read as broadly as possible, the Bartel decision could 
prohibit the nonconsensual disclosure of all kinds of 
records traditionally treated as being in the public 
domain. These include, for example, agency telephone 
directories compiled from personnel systems of records, 
press releases on employee accomplishments, etc. 

It should be noted that Judge Wald acknowledged but 
declined to address the issue of information 
traditionally thought to be in the public domain, and 
whether such information could be released without a FOIA 
request in hand. Our guidance below aims at providing 
insight into this area. By doing so, however, we do not 
mean to suggest that we think the Bartel opinion is 
otherwise correct. 
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b. Recommended Agency Action 

In an attempt to clarify what may be released under 

(b)(2) without an actual FOIA request in hand, we offer 

the following interpretation: 

"Subsection (b) (2) is intended to "preserve the 
status quo as interpreted by the courts regarding 
the disclosure of personal information" to the 
public under the Freedom of Information Act. 
( Congressional Record p. S21817, December 17, 1974 
and p. H12244, December 18, 1974). It absolves an 
agency from having to obtain the consent of an 
individual before disclosing a record about him or 
her to a member of the public to whom the agency is 
required to disclose such information under the 
Freedom of Information Act. The use of the term 
"required" indicates that agencies may not rely upon 
(b) (2) to make public any record which the FOIA 
permits them to withhold. Thus, an agency's initial 
action in contemplating a (b) (2) disclosure should 
be to evaluate the disclosure in terms of each 
exemption provision of the Freedom of Information 
Act. If it is satisfied that no exemption could be 
applied and that the disclosure would thus be 
"required" under the FOIA, it may disclose pursuant 
to Section (b) (2) of the Privacy Act. 

The question of whether an agency must have a FOIA 
request in hand before disclosing pursuant to (b) (2) 
turns on the character of the records in question. 
Agencies may continue to disclose, without a 
specific FOIA request for them, records 
traditionally held to be in the public domain or 
which are required to be disclosed to the public 
such as many of the final orders and opinions of 
quasi- judicial agencies, press releases, telephone 
directories, organizational charts, etc. Records 
which fall outside the scope of this category should 
not be disclosed pursuant to (b) (2) without a FOIA 
request in hand, even if the agency would be 
required to disclose them pursuant to such a 
request. Where appropriate, however, agencies may 
disclose such records by obtaining the record 
subject's consent, or by relying on the other 
disclosure exceptions in section (b) of the Privacy 
Act, such as the routine use provision." 

3 . Problem - The Relationship between the Privacy Act 
and the Freedom of Information Act. 


Guidance we issued in March of this year on the 
relationship between the Freedom of Information Act and 
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the Privacy Act has been invalidated by enactment of H.R. 
5164 (P.L. 98-477). 

a . Background 

Section (b) (3) of the Freedom of Information Act permits 
the withholding of records in response to a FOIA request 
if such withholding is permitted by another statute the 
terms of which conform to the narrow and specific 
provisions of Section (b)(3). 

Our original guidance on the relationship between the 
Privacy Act and the FOIA urged the agencies not to treat 
the Privacy Act as a FOIA exemption (3) statute. 

Agencies were instructed to consider access requests from 
record subjects under both acts and to provide access 
under the act that gave the greatest amount of 
information. 

Starting in 1980, however, after lengthy analysis, the 
Department of Justice took the position in litigation 
that the Privacy Act was indeed a FOIA (b) (3) statute. 
This meant that agencies could use an applicable Privacy 
Act exemption to deny a record subject access if he made 
his request under the FOIA. On March 29, 1984, to 
conform our guidance on the issue to the Government's 
litigating position, we published a change to our 
original guidance in the Federal Register . 

The circuits split on the issue, with the Third and D.C. 
Circuits rejecting the Government's argument and the 
Fifth and Seventh agreeing that the Privacy Act is a 
(b)(3) statute. The issue was on the Supreme Court's 
calendar for Spring of 1985. 

Before the court could act, however, the Congress passed 
H.R. 5164 (P.L. 98-477) , which contained a section 
amending the Privacy Act by adding Section (q) (2) , which 
instructs agencies that they may not rely on a Privacy 
Act exemption to deny a record subject access to his 
records under the FOIA. 

b. Recommended Agency Action 

In responding to an individual's request for access to 
records about him that an agency is maintaining in a 
Privacy Act system of records, agencies should follow the 
guidance below which amends the guidance we published on 
March 29, 1984 (49 FR 12338): 

P.L. 98-477, added Section (q) (2) to the Privacy Act so 
that the entire section now reads as follow: 
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"Section (q) . Effect of Other Laws. Relationship 
of the Privacy Act to the Freedom of information 
Act. " 


"Subsection (q)(l). No agency shall rely on any 
exemption contained in section 552 of this title to 
withhold from an individual any record which is 
otherwise accessible to such individual under the 
provisions of this section. 

Subsection (q)(2). No agency shall rely on any 
exemption in this section to withhold from an 
individual any record which is otherwise accessible 
to such individual under the provisions of section 
552 of this title." 

The two provisions of this section work together to 
forbid agencies from (a) relying on a Freedom of 
Information Act exemption to deny an individual access to 
records to which he is entitled under the Privacy Act, 
and (b) relying on a Privacy Act exemption to deny access 
to records accessible under the FOIA. 

Subsection (q) (2) was added to the Privacy Act in 1984 by 
P.L. 98-477 to make it clear that the Privacy Act is not 
a FOIA exemption (b) (3) statute. Section (b) (3) of the 
FOIA permits agencies to withhold records sought under 
that statute if the material is specifically barred from 
disclosure by another statute. 

The effect of section (q) (2) is to make the access 
exemptions of the Privacy Act unavailable to an agency 
when it processes a record subject's FOIA request for 
access to records maintained in a Privacy Act system of 
records. In order to withhold records in response to 
such requests, agencies can only rely on an applicable 
FOIA exemption. 

Similarly, section (q) (1) , which was an original 
provision of the Privacy Act, has always prohibited 
agencies from using a FOIA exemption to deny an 
individual access to a record about him that is otherwise 
accessible under the Privacy Act. 

Whether agencies should process a request by an 
individual for access to his or her record under Privacy 
Act or Freedom of Information Act procedures depends upon 
how the requester couches the request. The following 
examples assume that an individual, as defined by the 
Privacy Act, has asked for access to records about 
himself that an agency is maintaining in a system of 
records : 
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o The request cites the Privacy Act . In this 

situation, the agency would process the request 
under the Privacy Act and apply, if appropriate, any 
applicable Privacy Act exemption. The agency would 
adhere to the fee provisions, time limitations, and 
appeal processes that are either required by the 
Privacy Act or by the agency's Privacy Act 
regulation. 

° The request cites the FOIA . Here, the agency would 
process the request under the provisions of the FOIA 
and apply, as appropriate, any applicable FOIA 
exemption. The agency would adhere to the fee, 
time, and administrative appeal requirements of the 
FOIA and its own implementing regulation. 

° The request cites both the Privacy and Freedom of 
Information Acts, or it cites no Act at all . In - 
responding to either of these requests, the agency 
must process the request under both Acts. This dual 
processing is required in response to the first kind 
of request because the individual has cited both 
Acts specifically. It is required under the second 
kind of request (no Act cited), because the request 
meets the statutory terms of both a FOIA and a 
Privacy Act request. The effect of processing under 
both Acts is that the agency, in applying any access 
restrictions, is forced to rely on the weakest 
exemption available, generally a FOIA exemption. 

For requests which are processed under the 
provisions of both Acts, agencies should follow the 
Privacy Act's fee provisions and charge requesters 
only for the cost of reproduction and not for search 
since the records are maintained in systems of 
records and should be readily available. As to time 
limits, agencies should follow the FOIA time limits 
in processing dual requests. 
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